1. Field
The present application relates to systems and methods for authenticating electronic communications that are transmitted through computer networks, and more particularly, to authenticating e-mails prior to delivery to the intended recipient.
2. Description of Related Art
Unsolicited, unwanted commercial e-mail messages, known commonly as “spam”, comprise an increasing volume of e-mail traffic worldwide. At the same time, many consumers want to receive some unsolicited commercial e-mail relating to selected areas of interest. Such e-mail may include, for example, special offers, news or price reductions, news about new product releases, receipts of completed transactions, shipping notices, or other information of interest. Although various methods have been developed to block or filter spam before it reaches its intended recipients, a problem persists in determining exactly where to draw the line between unwanted spam and desirable commercial e-mail.
The need to distinguish between spam and legitimate commercial e-mail is especially important today, as more and more people rely on the Internet to conduct financial transactions and to make online purchases through a variety of commercial web sites. E-mails relating to these transactions, or e-mails from other authorized commercial sources, may be misclassified as spam and blocked from delivery to the intended recipients. Thus, spam blockers and filters may suffer from being either under inclusive or over inclusive as to the e-mails which are blocked as spam. In the first instance, the e-mail recipient may continue to receive a volume of spam e-mail, rendering the spam filter useless. In the second instance, however, the e-mail recipient may not receive legitimate e-mails which are misclassified as spam by virtue of their commercial nature.
Many spam blockers and filters have attempted to solve this problem by creating a targeted list of e-mail or IP addresses that are known to be used by senders of unwanted messages. These are known as “blacklists” and aid in blocking messages from the listed addresses. Blacklisting, however, can be readily evaded by the simple expedient of altering the sender's e-mail address. In addition, spammers may forge information contained in the e-mail, so that spam appears to originate from a legitimate source. Furthermore, spammers have increasingly sought to compromise the security of consumer and business computers to send spam from an enormous variety of IP addresses. Thus, targeted approaches that attempt to filter out spam based on its source are not as effective as desired.
Moreover, there is a need to distinguish between fraudulent and legitimate commercial e-mails. Fraudulent e-mail includes those in which the e-mail is forged or altered to appear to have originated from a source other than its actual source. There are no safeguards in normal Simple Mail Transfer Protocol (SMTP) to prevent such e-mails from being sent. Thus, spammers can send e-mails which purport to originate from senders that the intended recipient would ordinarily trust. This practice also allows spammers to avoid receiving non-delivery notifications (bounces) to their real addresses, fraudsters to cover their tracks and remain anonymous and phishers (password fishers) to impersonate well-known, trusted identities in order to steal passwords or other sensitive, personal information from users.
Various approaches have been proposed to prevent sender address forgery. One approach is Sender Policy Framework (SPF), an extension to SMTP which allows software to identify and reject forged addresses in the envelope sender address, e.g., SMTP MAIL FROM (Return-Path). SPF allows the owner of an Internet domain to use a special format of DNS TXT records to specify which hosts are authorized to transmit e-mails for a given domain. Thus, a receiving mail server performs a check to determine whether the e-mail comes from an authorized host. Typically, such checks are done by the receiving mail transfer agent, but can be performed elsewhere in the mail processing chain so long as the required information is available and reliable. SPF is further defined in RFC 4408.
One significant benefit of SPF is to those whose e-mail addresses are forged in the Return-Paths. They receive a large mass of unsolicited error messages and other auto-replies, making it difficult to use e-mail normally. If such people use SPF to specify their legitimate sending IPs with a FAIL result for all other IPs, then receivers checking SPF can reject forgeries, reducing the amount of back-scatter.
The SPF method, however, may be subject to certain vulnerabilities because it depends on the reliability of the DNS TXT records identifying authorized hosts and on the security of authorized hosts. Moreover, SPF normally only validates the domain of the envelope sender (in the Return-Path). Thus, domains that share mail senders (e.g. with virtual hosting) can forge each others' domain and SPF does not validate that a given e-mail actually comes from the claimed user, because it operates at the network level.
It would be therefore desirable to overcome these and other limitations of the prior art. Systems and methods are needed, which can distinguish between spam and legitimate commercial e-mail and, in certain embodiments, more effectively determine whether an e-mail originates from a forged source.